416d9f0cc478947076e6929862c3bb666d675732fb9771bc2445db2c406c47c7

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

631103f5a0f47552a4a1903b641d8e98.html
Size

3.5MB
MD5

631103f5a0f47552a4a1903b641d8e98
SHA1

cf9d0bebd69650827c88ae51602d8f506ad9783a
SHA256

416d9f0cc478947076e6929862c3bb666d675732fb9771bc2445db2c406c47c7
SHA512

df12b4a9f54d3a55e3c9d462efb5ec5945e155e77e15e30025ffc5f646ac7096bfb8a39f66ac42d882b6e0e035f4a7ce3af47650532ba699c3d0af693533ca25
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfW:ovpjte4tT6NW

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5398F231-A4CF-11EE-9C0C-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c33b40dc38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001fbb61a034cb2270ee5833f67b09fb62abe54e2401a23d8c4c92fa3f74636b60000000000e8000000002000020000000d00cc1bbbec03f179eb2be3c30ea7141e922ce01303a85ed1880c63300091630900000001c4fb0448c4415ad32ffd14737eaa1a1fe43d1d2e90a573449af7d74ac300b0695237dde6af7fb86ab1dfe25f49df1d048b0fe7bc57d66b22df79f4d5c6f60543bd97aa9731c1edc9fdab4b47d69ee1a88f6b90f7d20decf7ff3b9eaae0e4b62d10e3536552c59a42f41fe2a10f0a6af0bbacc95f4a9cd89a4155be9300be399df1e5475fa38684e2b6a4116213a6d594000000087980693d0e6b543411dd3d1296e1242ad84fc578c842216fee6a7243a89a794b423dde688db0af832030621ef50ca91f06d4fdb77467184e387a7aa55b95c81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a8db4888cba3583b2e518d95f489c9c788ade7ba52cefe31cda08c37585b0035000000000e80000000020000200000001a09a05baade5959366a53cbd1ec48ef785c23bd0279decffb6d21c84b4679b2200000002f8c1dfdd626afad765ea7aa35e257e549c1f5e2d0db794762d9cc06c78763fa400000006ce0bacfe75665e70779d8fe28fe1bc0e50b6a3eefb36324816ea75898e68e8fbab38bf3576262f1bb1c862f527c209f070e0aae67249d1cd6fd210020737b53	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409853959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2220	1956	iexplore.exe	14
PID 1956 wrote to memory of 2220	1956	iexplore.exe	14
PID 1956 wrote to memory of 2220	1956	iexplore.exe	14
PID 1956 wrote to memory of 2220	1956	iexplore.exe	14

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\631103f5a0f47552a4a1903b641d8e98.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02f38c0126e774ba88b42e01e26b3711

SHA1
afd8d053ba9ba826bcbea175ab2ba6b7bb884b15

SHA256
090cac50025ea78dd6013903dff189daf54a82e1fb413aefd4406f3c3b6d7a1e

SHA512
5fd2c38265e5939ffd556cfd4244e8d2214fc521a5d770e3c90f3ec54e3f5316497a313afac7cd193f6a2c91253545763e3578ea72b408683488c0a0721633b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9991a17ed65f9f4dde2d48858c24300f

SHA1
ae0f4bca5d1742ed6e1f90c46cc49ecf32a8e767

SHA256
2a34b3a07489ba00c66594b2ffd439028f144d5b362df13ceacc159e7bb19425

SHA512
d79afb1b757d90b6eb70fe43f5f63919de68a1b9b0ef5450acf99fe56364a59f666879bedaff5657dc9abeb53e16276a97f9a507a50b734a18cf6e87693b8654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0540308b487ec174e9b61caf944afc2

SHA1
4bcdcf35f87a465ad82045f8d3ee5967a7d53ea4

SHA256
447c38500bab86564ff1cb5e68bd13847d94012380e6db8655cfef5d98f24ea5

SHA512
96e5dcbd6a08ca7e6b3eebb6238266770ae97273d169df6ab833b1bb7ae33d4c5e234031510a4b64c3c7bfc2b7d389bd5887d793e439d69bb8d198a9a29b344f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f222fee219ef4d77ecf89af4471aba

SHA1
a2dc311f71fbe9bc86692d4861aa38389a69b9f3

SHA256
1f6970874f8953c309c94560acae952bc5c3183d350615ac7e1d3acf63f2181c

SHA512
ee0e96b70a19c6b35dd30335c6e8ca4210a112098f7a692a30c40be417a95ab05622e73ebfc809b3a92f1b49b0a233b45ffddb87217271d575c6fa4724586cfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a431f4d0eae5b733f81a585d20f81cf

SHA1
0a07a93299e1d083b19a80862c7478cb07b1763b

SHA256
df5e519c12537010b0dd49ad1da27afc75d4752c59a2c16a26c2b403160f03f9

SHA512
93a9251d1d4d8b37cbbf9a7d2b50f499c887359abd10374e195236a8ec0d9ba8c17356d9dbffa6bc0389bbdaeaa875f1040a61ac1669ebdf3eecb13efb26358b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e662d1c78a2606f01980e249cf5d97c

SHA1
223628eb86f90c4ffa45202099466b040f263a86

SHA256
076f52e61d967d5bf1c33d2d25a32343e0331db3fc5b2eac9f1bdb6f0ed33839

SHA512
4697fd1477b6a16e1e0f29971e003eda123f4523ba6dbe9badee62d663dbebde97ab7f46cc3e0e6d6a876c9cd58cd608019d438270c61537dda36ecb5619248f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43ba09f9c1a534a678a69d0f3d18b063

SHA1
b00e342a1a39ba57b948296ac613afce8582591c

SHA256
1dae96f46efd68020a9c3d8a0ed62d6d4d8ac0e5e6ec857d8db1e9d511dfd4db

SHA512
3439e2196a13e099cba845380d3465023ecfc0088a204ac2e6038ca373d2cd175ef92da37c21063d978693e53285187ee9d76e900f10224351906789210ecb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e0a39e20a35160ea53831e8b40a0652

SHA1
de28c8d16e787e595804884dd33dfe7cb2158703

SHA256
ec65ec9c47e63603e0a7a7bb5585c87f5cf4caab2ca87d712875bc2ef6cc7f24

SHA512
885c2ab20ee1983132f3b2a8f9f4a9946c80f65e2fe6d05f8499ef5a19b746d8d813472debab6dbfbdc47913b989f1a19e3d532f3d218b344d04de6110ea3f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f129b7b3a025baf81a4fd5b9550f6b8c

SHA1
fdfbe7bb995656fa4886b32ccf3513a9e5d30e7b

SHA256
3312bbf5622c3242854971a600aaf3f5f84cf5c5e2a63ec58674b1663a96a96e

SHA512
d17f6e2f6999f0d7add216facf5a264e58ce08d0cffe77e616a73fa70c5a825543a1c36548ac4a0c7a3e8f29e4071d7a2c5d3955c90666052e746e453a61a296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df523e26bd4097069d4593dca1db7a93

SHA1
c7e5cfaa53a44df8bd289058504ab352a81751ea

SHA256
8047b3f1640a2f971af4c115a00675d3e7083fc81880ea9497ea68d6aab1be8d

SHA512
241d88f4d9cae50f5f45e6c31c99b6b7384ac31499723639e1c1d103fbc26ede7309967dd6e44346847a5bfcbf49ceca5450754383f34b43dad2e8bc9ee68b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09c5790773936f4ce48072ace9ad5f6d

SHA1
da574f44101ad41230600ac154d62cffd00a3f5f

SHA256
72f068c1cfc5af635d59becfa471f1fd7df02e18867b4568faff653b5061aafa

SHA512
c88006785d1b436e7eaae801c52007eca09838515f91a1a0cbb8b69cf738ce3780209bb3f1e9ddb092f583173c776864aa17fe2bfffa03aaf1ccdec860f23207

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f196cd5bb68eb4bb2ecdfe5076e3ad

SHA1
7b554ae329e261ef6c307cfcc5908095b84c2942

SHA256
7de9ffa6f9fb8ea888e3059c5c68c312b237506c3cfe705315b525eb32721423

SHA512
1696f243300396127b25e59cc3216bd1dcd9a074920e2d1b6b42b5497bbe8d3e94be711eb6c29ea11a90eeab66938cc59a2d133d2fd40248380d934efc74bc07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702c6c6ec2c804bafbad06741fd063f4

SHA1
93c1ad686b9cbb391b90e874d063c61f0adb37b2

SHA256
baf5abd4adcd6e34df66ed2827452d658aaaea5a29ab0e5bc535fdb4e6d60977

SHA512
a1cb290fa4868f9868ca57f827141c7cb78dc316fe5fa8bf89595a90aa696f7861714daddd5680b44c323f5d96033151652e4a5e444adb1c3e224c11a5b8f04d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f26494bd7dac6180f5a73e20e6c700

SHA1
b8fa45e928f7779ee599056e2e5097d3d3d6f05c

SHA256
4f94364bf61514747dc392070b5dcd1f98181a30ee18e07173dfe2d5b245f9a0

SHA512
9b28a81b2cd5b0ec9bb8c38d5c0b28189f0a51156ac2348368f85f4bbc955c20ce5dcda1d5a5a25f3711b824b68f7bcec957faa08329a6c8afb5ff6b9860950b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab147C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar148F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit